Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Add more granular OAuth scopes (#7929)

Browse source 
* Add more granular OAuth scopes

* Add human-readable descriptions of the new scopes

* Ensure new scopes look good on the app UI

* Add tests

* Group scopes in screen and color-code dangerous ones

* Fix wrong extra scope
This commit is contained in:
Eugen Rochko 2018-07-05 18:31:35 +02:00 • committed by GitHub
parent ca2cc556f1
commit 1f6ed4f86a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
69 changed files with 295 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app/controllers/api/v1/statuses/favourited_by_accounts_controller.rb
View file

@ -3,7 +3,7 @@
class Api::V1::Statuses::FavouritedByAccountsController < Api::BaseController
include Authorization
before_action :authorize_if_got_token
before_action -> { authorize_if_got_token! :read, :'read:accounts' }
before_action :set_status
after_action :insert_pagination_headers
@ -71,11 +71,6 @@ class Api::V1::Statuses::FavouritedByAccountsController < Api::BaseController
raise ActiveRecord::RecordNotFound
end
def authorize_if_got_token
request_token = Doorkeeper::OAuth::Token.from_request(request, *Doorkeeper.configuration.access_token_methods)
doorkeeper_authorize! :read if request_token
end
def pagination_params(core_params)
params.slice(:limit).permit(:limit).merge(core_params)
end

2
app/controllers/api/v1/statuses/favourites_controller.rb
View file

@ -3,7 +3,7 @@
class Api::V1::Statuses::FavouritesController < Api::BaseController
include Authorization
before_action -> { doorkeeper_authorize! :write }
before_action -> { doorkeeper_authorize! :write, :'write:favourites' }
before_action :require_user!
respond_to :json

2
app/controllers/api/v1/statuses/mutes_controller.rb
View file

@ -3,7 +3,7 @@
class Api::V1::Statuses::MutesController < Api::BaseController
include Authorization
before_action -> { doorkeeper_authorize! :write }
before_action -> { doorkeeper_authorize! :write, :'write:mutes' }
before_action :require_user!
before_action :set_status
before_action :set_conversation

2
app/controllers/api/v1/statuses/pins_controller.rb
View file

@ -3,7 +3,7 @@
class Api::V1::Statuses::PinsController < Api::BaseController
include Authorization
before_action -> { doorkeeper_authorize! :write }
before_action -> { doorkeeper_authorize! :write, :'write:accounts' }
before_action :require_user!
before_action :set_status

7
app/controllers/api/v1/statuses/reblogged_by_accounts_controller.rb
View file

@ -3,7 +3,7 @@
class Api::V1::Statuses::RebloggedByAccountsController < Api::BaseController
include Authorization
before_action :authorize_if_got_token
before_action -> { authorize_if_got_token! :read, :'read:accounts' }
before_action :set_status
after_action :insert_pagination_headers
@ -68,11 +68,6 @@ class Api::V1::Statuses::RebloggedByAccountsController < Api::BaseController
raise ActiveRecord::RecordNotFound
end
def authorize_if_got_token
request_token = Doorkeeper::OAuth::Token.from_request(request, *Doorkeeper.configuration.access_token_methods)
doorkeeper_authorize! :read if request_token
end
def pagination_params(core_params)
params.slice(:limit).permit(:limit).merge(core_params)
end

2
app/controllers/api/v1/statuses/reblogs_controller.rb
View file

@ -3,7 +3,7 @@
class Api::V1::Statuses::ReblogsController < Api::BaseController
include Authorization
before_action -> { doorkeeper_authorize! :write }
before_action -> { doorkeeper_authorize! :write, :'write:statuses' }
before_action :require_user!
respond_to :json